[arch-security] [ASA-201506-2] cups: multiple issues

Levente Polyak anthraxx at archlinux.org
Wed Jun 10 01:29:59 UTC 2015

Arch Linux Security Advisory ASA-201506-2

Severity: Critical
Date    : 2015-06-10
CVE-ID  : CVE-2015-1158 CVE-2015-1159
Package : cups
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE


The package cups before version 2.0.3-1 is vulnerable to multiple issues
including arbitrary code execution, privilege escalation and cross-side


Upgrade to 2.0.3-1.

# pacman -Syu "cups>=2.0.3-1"

The problems have been fixed upstream in version 2.0.3.




- CVE-2015-1158 (arbitrary code execution, privilege escalation)

An issue with how localized strings are handled in cupsd allows a
reference counter to over-decrement when handling certain print job
request errors. As a result, an attacker can prematurely free an
arbitrary string of global scope, creating a dangling pointer to a
repurposed block of memory on the heap. The dangling pointer causes ACL
verification to fail when parsing 'admin/conf' and 'admin' ACLs. The ACL
handling failure results in unrestricted access to privileged
operations, allowing an unauthenticated remote user to upload a
replacement CUPS configuration file and mount further attacks.

- CVE-2015-1159 (cross-side scripting)

A cross-site scripting bug in the CUPS templating engine allows this bug
to be exploited when a user browses the web. In certain cases, the CGI
template can echo user input to file rather than escaping the text
first. This may be used to set up a reflected XSS attack in the QUERY
parameter of the web interface help page. By default, many linux
distributions run with the web interface activated.


A remote attacker is able to use a cross-side scripting flaw in order to
send a malicious print request that is leading to arbitrary code
execution and privilege escalation.



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20150610/c1cae787/attachment.asc>

More information about the arch-security mailing list